Last updated: 24/04/2026

This privacy statement is for residents who live in a property where the building owner, manager, residents’ management company or other responsible person uses the RiskBase Engage platform.

RiskBase Engage helps your building’s responsible person understand whether residents may need additional assistance in the event of a fire or other building emergency, and helps them keep that information up to date.

This statement is a short, resident-friendly summary. You can read the full privacy terms here.

1. Who is responsible for your information?

Your building owner, building manager, residents’ management company, responsible person or other organisation responsible for fire safety at your building is usually the controller of your personal information. This means they decide why your information is collected and how it is used.

RiskBase Limited provides the RiskBase Engage platform. In most cases, RiskBase acts as a processor, which means RiskBase handles your information on behalf of, and under the instructions of, your building’s controller.

RiskBase may act as controller for limited purposes relating to its own business and platform operations, such as maintaining system security, managing support communications and keeping audit logs where RiskBase is legally required or has a legitimate business need to do so. The full privacy terms explain this in more detail.

2. What information are you asked for?

You may be asked for a small amount of information to help your building’s responsible person plan how to support you in an emergency. This may include:

• your name;

• your flat or unit number;

• how many people live with you;

• whether you may need help to leave the building in an emergency; and

• a brief note about the best way to assist you, if you choose to provide one.

This may include information about mobility, vision, hearing, cognitive impairment, disability or other circumstances that affect your ability to evacuate safely.

3. What information should you not provide?

Please do not provide detailed medical information unless it is necessary and you are happy to provide it.

For example, your building’s responsible person will not usually need:

• medical diagnoses;

• lists of medication;

• your NHS number;

• your blood type; or

• copies of medical records.

The aim is to understand what assistance you may need in an emergency, not to collect your full medical history.

4. Why is this information collected?

Your building’s responsible person may have legal duties to assess, manage and reduce fire-safety risks, provide relevant safety information, and plan for residents who may need additional assistance in an emergency.

Depending on the type, height and evacuation strategy of your building, these duties may arise under laws and guidance relating to fire safety and building safety, including:

• the Regulatory Reform (Fire Safety) Order 2005;

• the Fire Safety (England) Regulations 2022;

• the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025; and

• the Building Safety Act 2022.

RiskBase Engage helps your building’s responsible person collect, manage, update and share relevant information for these purposes.

5. Is it voluntary?

In most cases, yes. It is your choice whether to provide this information.
If you choose not to provide it, your building’s responsible person may not be able to plan specific assistance for you in advance. However, emergency services and building staff will still do what they can to help keep residents safe in an emergency.

Where explicit consent is required for particular information or sharing, you can withdraw that consent at any time.

6. How will your information be used?

Your information may be used to:

• help your building’s responsible person understand who may need assistance in an emergency;

• prepare or maintain an evacuation plan or other safety arrangement for your building;

• keep your information up to date;

• allow trained staff or authorised contractors to support building safety arrangements;

• share relevant information with the local fire and rescue service where appropriate; and

• maintain audit, consent and security records.
  Your information will not be used for marketing, and RiskBase will not sell your information.

7. Who can see your information?

Depending on the arrangements for your building, your information may be seen by:

• your building’s responsible person or authorised building management team;

• trained staff or trusted contractors who support fire-safety or emergency-planning arrangements;

• the local fire and rescue service, where required or where you have given the necessary consent; and

• RiskBase staff or technical providers, only where needed to operate, secure and support the RiskBase Engage platform.

RiskBase staff do not use resident information for their own purposes when RiskBase is acting as processor. They handle it on the controller’s instructions and subject to confidentiality and security controls.

8. Fire and rescue service sharing

Your building’s responsible person may share relevant information with the local fire and rescue service so that they can assist residents in an emergency or plan for emergency response.

Where the law or applicable guidance requires your explicit informed consent before information is shared with the fire and rescue service in advance, your information will only be shared for that purpose if you have given that consent.

In a life-threatening emergency, information may be shared where necessary to protect life.

Depending on the arrangements for your building and local fire and rescue service, information may be made available digitally through RiskBase Engage or through another secure method, such as an on-site secure information box.

9. Where is your information stored?

Resident information is stored securely using appropriate technical and organisational measures, including access controls and encryption where appropriate.

RiskBase and your building’s controller aim to keep resident information within the UK or EEA unless appropriate safeguards are in place. The full privacy terms explain how international transfers are handled if they ever apply.

10. How long is your information kept?

You may be asked to check or confirm your information periodically, usually at least once a year.

Your active resident record should be deleted or anonymised when it is no longer needed, for example when you move out or no longer require assistance planning.

Unless a longer period is legally required or reasonably necessary, the aim is usually to delete or anonymise the active resident record within 12 months of it no longer being needed, and in any event within 3 years of your last update or confirmation that the information remains accurate.

A limited audit record may be kept for longer where necessary to show that consent, updates, deletion requests or safety processes were handled properly.

11. Your choices and rights

Depending on the circumstances, you may have rights to:

• ask for a copy of your information;

• ask for inaccurate information to be corrected;

• ask for information to be deleted;

• withdraw consent;

• object to certain uses of your information;

• restrict certain uses of your information; and

• complain about how your information is handled.

Because your building’s controller is usually responsible for deciding how your resident information is used, some requests may need to be handled by your building’s controller rather than by RiskBase directly.

You can contact your building’s responsible person using the contact details they have provided to you. You can also contact RiskBase at support@riskbase.uk or through any secure “request my data” form made available through RiskBase Engage.

If RiskBase is responsible for the information you are asking about, RiskBase will handle your request. If the information is controlled by your building owner, manager, residents’ management company or other responsible person, RiskBase will help identify the right organisation and will either pass your request to them or help put you in touch with them.

You can also complain to the Information Commissioner’s Office at www.ico.org.uk.

12. Accessibility

This information can be provided in other formats or languages where reasonably possible. Please tell your building’s responsible person or RiskBase what you need.

13. How to give or change consent

You can give, change or withdraw consent using the RiskBase Engage form or by contacting your building’s responsible person.

Where RiskBase receives a consent-related request, it will record or pass on that request in accordance with the arrangements agreed with your building’s controller.